xypriss 9.0.13 → 9.1.1

package/dist/esm/src/middleware/built-in/security/PathTraversalDetector.js

@@ -1,210 +0,0 @@
-/**
- * Path Traversal Detection Module
- *
- * Detects and prevents directory traversal attacks with intelligent
- * false positive avoidance for legitimate file paths
- */
-class PathTraversalDetector {
-    constructor(config = {}) {
-        // High-risk path traversal patterns
-        this.highRiskPatterns = [
-            // Classic traversal with multiple levels
-            /(\.\.[\/\\]){2,}/g,
-            // URL encoded traversal
-            /(%2e%2e[\/\\]|%2e%2e%2f|%2e%2e%5c)/gi,
-            // Double URL encoded
-            /(%252e%252e[\/\\]|%252e%252e%252f)/gi,
-            // Unicode/UTF-8 encoded
-            /(\.\.%c0%af|\.\.%c1%9c)/gi,
-            // Null byte injection
-            /\.\.[\/\\].*%00/g,
-            // Absolute paths (Unix/Windows)
-            /^(\/|\\\\|[a-zA-Z]:\\)/,
-            // System directories
-            /(\/etc\/|\/proc\/|\/sys\/|\/dev\/|C:\\Windows\\|C:\\Program Files\\)/gi,
-            // Traversal with encoded slashes
-            /\.\.(%2f|%5c)/gi,
-        ];
-        // Medium-risk patterns (context-dependent)
-        this.mediumRiskPatterns = [
-            // Single parent directory reference
-            /\.\.[\/\\]/g,
-            // Hidden files (Unix)
-            /\/\.[^\/]+/g,
-            // Backup files
-            /\.(bak|backup|old|tmp|swp)$/gi,
-            // Config files
-            /\.(conf|config|ini|env)$/gi,
-        ];
-        this.config = {
-            enabled: config.enabled ?? true,
-            strictMode: config.strictMode ?? false,
-            logAttempts: config.logAttempts ?? true,
-            blockOnDetection: config.blockOnDetection ?? true,
-            falsePositiveThreshold: config.falsePositiveThreshold ?? 0.6,
-            customPatterns: config.customPatterns ?? [],
-            allowedPaths: config.allowedPaths ?? [],
-            allowedExtensions: config.allowedExtensions ?? ['.jpg', '.png', '.pdf', '.txt'],
-            maxDepth: config.maxDepth ?? 3,
-        };
-    }
-    /**
-     * Detect path traversal attempts
-     */
-    detect(path, context) {
-        if (!path || typeof path !== 'string') {
-            return {
-                isMalicious: false,
-                confidence: 0,
-                detectedPatterns: [],
-                riskLevel: 'LOW',
-            };
-        }
-        const result = {
-            isMalicious: false,
-            confidence: 0,
-            detectedPatterns: [],
-            sanitizedInput: path,
-            riskLevel: 'LOW',
-        };
-        // Check if path is in allowed paths
-        if (this.isAllowedPath(path)) {
-            return result;
-        }
-        // High-risk pattern detection
-        let highRiskScore = 0;
-        this.highRiskPatterns.forEach((pattern, index) => {
-            const matches = path.match(pattern);
-            if (matches) {
-                const patternName = this.getHighRiskPatternName(index);
-                result.detectedPatterns.push(`${patternName}: ${matches.join(', ')}`);
-                highRiskScore += 0.8;
-            }
-        });
-        // Medium-risk pattern detection
-        let mediumRiskScore = 0;
-        this.mediumRiskPatterns.forEach((pattern) => {
-            const matches = path.match(pattern);
-            if (matches) {
-                mediumRiskScore += 0.2 * matches.length;
-            }
-        });
-        // Calculate depth
-        const depth = this.calculatePathDepth(path);
-        if (depth > this.config.maxDepth) {
-            result.detectedPatterns.push(`Excessive depth: ${depth}`);
-            mediumRiskScore += 0.3;
-        }
-        // Legitimacy checks
-        const legitimacyScore = this.calculateLegitimacyScore(path);
-        // Calculate final confidence
-        result.confidence = Math.max(0, highRiskScore + mediumRiskScore * 0.4 - legitimacyScore);
-        result.confidence = Math.min(result.confidence, 1.0);
-        // Determine risk level
-        if (result.confidence >= 0.8) {
-            result.riskLevel = 'CRITICAL';
-            result.isMalicious = true;
-        }
-        else if (result.confidence >= this.config.falsePositiveThreshold) {
-            result.riskLevel = 'HIGH';
-            result.isMalicious = true;
-        }
-        else if (result.confidence >= 0.3) {
-            result.riskLevel = 'MEDIUM';
-            result.isMalicious = false;
-        }
-        // Sanitize path
-        if (result.confidence >= 0.3) {
-            result.sanitizedInput = this.sanitizePath(path);
-        }
-        // Log attempts
-        if (this.config.logAttempts && result.confidence >= 0.7) {
-            this.logAttempt(path, result);
-        }
-        return result;
-    }
-    /**
-     * Sanitize path by removing traversal sequences
-     */
-    sanitizePath(path) {
-        let sanitized = path;
-        // Remove all traversal sequences
-        sanitized = sanitized.replace(/\.\.[\/\\]/g, '');
-        // Remove URL encoded traversal
-        sanitized = sanitized.replace(/%2e%2e[\/\\%]/gi, '');
-        // Remove null bytes
-        sanitized = sanitized.replace(/%00/g, '');
-        // Normalize slashes
-        sanitized = sanitized.replace(/[\\]/g, '/');
-        // Remove duplicate slashes
-        sanitized = sanitized.replace(/\/+/g, '/');
-        // Remove leading slash if present
-        sanitized = sanitized.replace(/^\//, '');
-        return sanitized;
-    }
-    /**
-     * Check if path is in allowed paths
-     */
-    isAllowedPath(path) {
-        return this.config.allowedPaths.some(allowed => path.startsWith(allowed));
-    }
-    /**
-     * Calculate path depth
-     */
-    calculatePathDepth(path) {
-        const normalized = path.replace(/[\\]/g, '/');
-        const parts = normalized.split('/').filter(p => p && p !== '.');
-        return parts.length;
-    }
-    /**
-     * Calculate legitimacy score
-     */
-    calculateLegitimacyScore(path) {
-        let score = 0;
-        // Check for allowed extensions
-        const hasAllowedExt = this.config.allowedExtensions.some(ext => path.toLowerCase().endsWith(ext));
-        if (hasAllowedExt) {
-            score += 0.3;
-        }
-        // Simple filename pattern (no traversal)
-        if (/^[a-zA-Z0-9_\-\.]+$/.test(path)) {
-            score += 0.3;
-        }
-        // Reasonable path depth
-        const depth = this.calculatePathDepth(path);
-        if (depth <= 2) {
-            score += 0.2;
-        }
-        return Math.min(score, 0.5);
-    }
-    getHighRiskPatternName(index) {
-        const names = [
-            'Multiple traversal sequences',
-            'URL encoded traversal',
-            'Double URL encoded traversal',
-            'Unicode encoded traversal',
-            'Null byte injection',
-            'Absolute path',
-            'System directory access',
-            'Encoded slash traversal',
-        ];
-        return names[index] || `High-risk pattern ${index}`;
-    }
-    logAttempt(path, result) {
-        console.warn('[PathTraversal] Attack detected:', {
-            timestamp: new Date().toISOString(),
-            path: path.substring(0, 100),
-            confidence: result.confidence,
-            patterns: result.detectedPatterns,
-        });
-    }
-    updateConfig(newConfig) {
-        this.config = { ...this.config, ...newConfig };
-    }
-    getConfig() {
-        return { ...this.config };
-    }
-}
-
-export { PathTraversalDetector as default };
-//# sourceMappingURL=PathTraversalDetector.js.map

package/dist/esm/src/middleware/built-in/security/PathTraversalDetector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PathTraversalDetector.js","sources":["../../../../../../src/middleware/built-in/security/PathTraversalDetector.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA;;;;;AAKG;AAUH,MAAM,qBAAqB,CAAA;AA6CvB,IAAA,WAAA,CAAY,SAA8B,EAAE,EAAA;;AAzC3B,QAAA,IAAA,CAAA,gBAAgB,GAAG;;YAEhC,mBAAmB;;YAGnB,sCAAsC;;YAGtC,sCAAsC;;YAGtC,2BAA2B;;YAG3B,kBAAkB;;YAGlB,wBAAwB;;YAGxB,wEAAwE;;YAGxE,iBAAiB;SACpB,CAAC;;AAGe,QAAA,IAAA,CAAA,kBAAkB,GAAG;;YAElC,aAAa;;YAGb,aAAa;;YAGb,+BAA+B;;YAG/B,4BAA4B;SAC/B,CAAC;QAGE,IAAI,CAAC,MAAM,GAAG;AACV,YAAA,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;AAC/B,YAAA,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;AACtC,YAAA,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;AACvC,YAAA,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;AACjD,YAAA,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,GAAG;AAC5D,YAAA,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;AAC3C,YAAA,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;AACvC,YAAA,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;AAC/E,YAAA,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;SACjC,CAAC;KACL;AAED;;AAEG;IACH,MAAM,CAAC,IAA+B,EAAE,OAAqB,EAAA;QACzD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YACnC,OAAO;AACH,gBAAA,WAAW,EAAE,KAAK;AAClB,gBAAA,UAAU,EAAE,CAAC;AACb,gBAAA,gBAAgB,EAAE,EAAE;AACpB,gBAAA,SAAS,EAAE,KAAK;aACnB,CAAC;SACL;AAED,QAAA,MAAM,MAAM,GAA4B;AACpC,YAAA,WAAW,EAAE,KAAK;AAClB,YAAA,UAAU,EAAE,CAAC;AACb,YAAA,gBAAgB,EAAE,EAAE;AACpB,YAAA,cAAc,EAAE,IAAI;AACpB,YAAA,SAAS,EAAE,KAAK;SACnB,CAAC;;AAGF,QAAA,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;AAC1B,YAAA,OAAO,MAAM,CAAC;SACjB;;QAGD,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,KAAI;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE;gBACT,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACvD,gBAAA,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAA,EAAA,EAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAE,CAAC,CAAC;gBACtE,aAAa,IAAI,GAAG,CAAC;aACxB;AACL,SAAC,CAAC,CAAC;;QAGH,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,OAAO,KAAI;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE;AACT,gBAAA,eAAe,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;aAC3C;AACL,SAAC,CAAC,CAAC;;QAGH,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC9B,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAoB,iBAAA,EAAA,KAAK,CAAE,CAAA,CAAC,CAAC;YAC1D,eAAe,IAAI,GAAG,CAAC;SAC1B;;QAGD,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;;AAG5D,QAAA,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,GAAG,GAAG,eAAe,CAAC,CAAC;AACzF,QAAA,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;;AAGrD,QAAA,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE;AAC1B,YAAA,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC;AAC9B,YAAA,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;SAC7B;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;AAChE,YAAA,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;AAC1B,YAAA,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;SAC7B;AAAM,aAAA,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE;AACjC,YAAA,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;AAC5B,YAAA,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;SAC9B;;AAGD,QAAA,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE;YAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;SACnD;;AAGD,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE;AACrD,YAAA,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;SACjC;AAED,QAAA,OAAO,MAAM,CAAC;KACjB;AAED;;AAEG;AACK,IAAA,YAAY,CAAC,IAAY,EAAA;QAC7B,IAAI,SAAS,GAAG,IAAI,CAAC;;QAGrB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;;QAGjD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;;QAGrD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;;QAG1C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;;QAG5C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;;QAG3C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAEzC,QAAA,OAAO,SAAS,CAAC;KACpB;AAED;;AAEG;AACK,IAAA,aAAa,CAAC,IAAY,EAAA;AAC9B,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,IACxC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAC3B,CAAC;KACL;AAED;;AAEG;AACK,IAAA,kBAAkB,CAAC,IAAY,EAAA;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,MAAM,CAAC;KACvB;AAED;;AAEG;AACK,IAAA,wBAAwB,CAAC,IAAY,EAAA;QACzC,IAAI,KAAK,GAAG,CAAC,CAAC;;QAGd,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,IACxD,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC,CAAC;QACF,IAAI,aAAa,EAAE;YACf,KAAK,IAAI,GAAG,CAAC;SAChB;;AAGD,QAAA,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAClC,KAAK,IAAI,GAAG,CAAC;SAChB;;QAGD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC5C,QAAA,IAAI,KAAK,IAAI,CAAC,EAAE;YACZ,KAAK,IAAI,GAAG,CAAC;SAChB;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;KAC/B;AAEO,IAAA,sBAAsB,CAAC,KAAa,EAAA;AACxC,QAAA,MAAM,KAAK,GAAG;YACV,8BAA8B;YAC9B,uBAAuB;YACvB,8BAA8B;YAC9B,2BAA2B;YAC3B,qBAAqB;YACrB,eAAe;YACf,yBAAyB;YACzB,yBAAyB;SAC5B,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAqB,kBAAA,EAAA,KAAK,EAAE,CAAC;KACvD;IAEO,UAAU,CAAC,IAAY,EAAE,MAA+B,EAAA;AAC5D,QAAA,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;AAC7C,YAAA,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,gBAAgB;AACpC,SAAA,CAAC,CAAC;KACN;AAED,IAAA,YAAY,CAAC,SAAuC,EAAA;AAChD,QAAA,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;KAClD;IAED,SAAS,GAAA;AACL,QAAA,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;KAC7B;AACJ;;;;"}

package/dist/esm/src/middleware/built-in/security/RequestSignatureProtector.js

@@ -1,460 +0,0 @@
-import { Logger } from '../../../../shared/logger/Logger.js';
-import * as crypto from 'crypto';
-
-/**
- * XyRS - XyPriss Request Signature Protector
- * Validates request signatures for API authentication
- * Uses a predefined header name with developer-configured secret value
- * Enhanced with robust validation and security measures
- */
-class RequestSignatureProtector {
-    constructor(options, logger) {
-        this.HEADER_NAME = "XP-Request-Sig";
-        this.failedAttempts = new Map();
-        this.CLEANUP_INTERVAL = 60000; // 1 minute
-        // Strict validation of required secret
-        this.validateSecret(options.secret, options.minSecretLength);
-        this.config = {
-            errorMessage: "Invalid or missing request signature",
-            statusCode: 401,
-            debug: false,
-            caseSensitive: true,
-            trimValue: true,
-            maxHeaderLength: 512,
-            maxFailedAttempts: 5,
-            blockDuration: 15 * 60 * 1000, // 15 minutes
-            disableRateLimiting: false,
-            rateLimitScaleFactor: 1.0,
-            minSecretLength: 32,
-            timingSafeComparison: true,
-            rejectSuspiciousPatterns: true,
-            ...options,
-        };
-        // Store hashed version of secret for additional security
-        this.SECRET_HASH = this.hashSecret(this.config.secret);
-        // Initialize logger
-        this.logger =
-            logger ||
-                new Logger({
-                    enabled: true,
-                    level: "debug",
-                    components: { security: true },
-                    types: { debug: true },
-                });
-        // Start cleanup timer for failed attempts tracking
-        this.startCleanupTimer();
-        this.logSecurityEvent("info", "XyRS initialized with strict validation");
-    }
-    /**
-     * Get the request signature middleware function
-     */
-    getMiddleware() {
-        return (req, res, next) => {
-            this.handleRequest(req, res, next);
-        };
-    }
-    /**
-     * Handle incoming request and validate signature
-     */
-    handleRequest(req, res, next) {
-        const clientId = this.extractClientIdentifier(req);
-        // Check if client is currently blocked (if rate limiting is enabled)
-        if (!this.config.disableRateLimiting &&
-            this.isClientBlocked(clientId)) {
-            return this.blockRequest(res, "RATE_LIMITED", "Too many failed authentication attempts. Temporarily blocked.", clientId);
-        }
-        if (this.config.debug) {
-            this.logger.debug("security", "XyRS validating request signature");
-        }
-        // Strict header extraction
-        const signature = this.extractSignatureHeader(req);
-        if (signature === null) {
-            this.recordFailedAttempt(clientId);
-            return this.blockRequest(res, "MISSING_SIGNATURE", `Required header '${this.HEADER_NAME}' is missing or malformed`, clientId);
-        }
-        // Length validation to prevent DoS
-        if (!this.validateHeaderLength(signature)) {
-            this.recordFailedAttempt(clientId);
-            return this.blockRequest(res, "INVALID_HEADER_LENGTH", `Header value exceeds maximum allowed length`, clientId);
-        }
-        // Suspicious pattern detection
-        if (this.config.rejectSuspiciousPatterns &&
-            this.containsSuspiciousPatterns(signature)) {
-            this.recordFailedAttempt(clientId);
-            return this.blockRequest(res, "SUSPICIOUS_PATTERN", `Header contains suspicious or malicious patterns`, clientId);
-        }
-        // Process signature value
-        const processedSignature = this.processSignatureValue(signature);
-        const expectedSignature = this.processSignatureValue(this.config.secret);
-        // Validate signature with timing-safe comparison
-        const isValid = this.compareSignatures(processedSignature, expectedSignature);
-        if (!isValid) {
-            this.recordFailedAttempt(clientId);
-            this.logSecurityEvent("warning", "Invalid signature attempt", {
-                clientId,
-                signatureLength: signature.length,
-            });
-            return this.blockRequest(res, "INVALID_SIGNATURE", `Header '${this.HEADER_NAME}' value does not match expected signature`, clientId);
-        }
-        // Signature is valid - clear any failed attempts
-        this.clearFailedAttempts(clientId);
-        if (this.config.debug) {
-            this.logger.debug("security", "XyRS signature validation passed");
-        }
-        next();
-    }
-    /**
-     * Extract client identifier for rate limiting (IP-based)
-     */
-    extractClientIdentifier(req) {
-        // Try multiple methods to get real IP
-        const ip = req.ip ||
-            req.headers["x-forwarded-for"]?.split(",")[0]?.trim() ||
-            req.headers["x-real-ip"] ||
-            req.connection?.remoteAddress ||
-            req.socket?.remoteAddress ||
-            "unknown";
-        return this.sanitizeClientId(ip);
-    }
-    /**
-     * Sanitize client identifier
-     */
-    sanitizeClientId(clientId) {
-        // Remove IPv6 prefix if present
-        let sanitized = clientId.replace(/^::ffff:/, "");
-        // Keep only alphanumeric, dots, colons, and hyphens
-        sanitized = sanitized.replace(/[^a-zA-Z0-9.:_-]/g, "");
-        return sanitized || "unknown";
-    }
-    /**
-     * Strictly extract signature header with no fallbacks
-     */
-    extractSignatureHeader(req) {
-        if (!req.headers || typeof req.headers !== "object") {
-            return null;
-        }
-        // Only check lowercase version (standard HTTP header convention)
-        const headerKey = this.HEADER_NAME.toLowerCase();
-        const signature = req.headers[headerKey];
-        // Strict type checking
-        if (typeof signature !== "string") {
-            return null;
-        }
-        // Reject empty or whitespace-only headers
-        if (signature.length === 0 || /^\s*$/.test(signature)) {
-            return null;
-        }
-        return signature;
-    }
-    /**
-     * Validate header length to prevent DoS attacks
-     */
-    validateHeaderLength(signature) {
-        return (signature.length > 0 &&
-            signature.length <= (this.config.maxHeaderLength || 512));
-    }
-    /**
-     * Detect suspicious patterns in header value
-     */
-    containsSuspiciousPatterns(signature) {
-        // Check for common attack patterns
-        const suspiciousPatterns = [
-            /[<>\"'`]/g, // HTML/Script injection characters
-            /\.\./g, // Path traversal
-            /[\x00-\x08\x0B\x0C\x0E-\x1F]/g, // Control characters
-            /\${.*}/g, // Template injection
-            /\|\||&&/g, // Command injection
-            /(\r\n|\n|\r)/g, // CRLF injection
-        ];
-        return suspiciousPatterns.some((pattern) => pattern.test(signature));
-    }
-    /**
-     * Process signature value based on configuration
-     */
-    processSignatureValue(value) {
-        return this.config.trimValue ? value.trim() : value;
-    }
-    /**
-     * Compare signatures with optional timing-safe comparison
-     */
-    compareSignatures(received, expected) {
-        // Always check lengths first (fast rejection)
-        if (received.length !== expected.length) {
-            return false;
-        }
-        if (this.config.timingSafeComparison) {
-            return this.timingSafeEqual(received, expected);
-        }
-        // Standard comparison
-        return this.config.caseSensitive
-            ? received === expected
-            : received.toLowerCase() === expected.toLowerCase();
-    }
-    /**
-     * Timing-safe string comparison to prevent timing attacks
-     */
-    timingSafeEqual(a, b) {
-        // Convert to buffers for timing-safe comparison
-        const bufA = Buffer.from(this.config.caseSensitive ? a : a.toLowerCase());
-        const bufB = Buffer.from(this.config.caseSensitive ? b : b.toLowerCase());
-        if (bufA.length !== bufB.length) {
-            return false;
-        }
-        try {
-            return crypto.timingSafeEqual(bufA, bufB);
-        }
-        catch {
-            return false;
-        }
-    }
-    /**
-     * Check if client is currently blocked due to failed attempts
-     */
-    isClientBlocked(clientId) {
-        const attempt = this.failedAttempts.get(clientId);
-        if (!attempt || !attempt.blockedUntil) {
-            return false;
-        }
-        const now = Date.now();
-        if (now >= attempt.blockedUntil) {
-            // Block period expired
-            this.failedAttempts.delete(clientId);
-            return false;
-        }
-        return true;
-    }
-    /**
-     * Record failed authentication attempt
-     */
-    recordFailedAttempt(clientId) {
-        // Skip recording if rate limiting is disabled
-        if (this.config.disableRateLimiting) {
-            return;
-        }
-        const now = Date.now();
-        const attempt = this.failedAttempts.get(clientId) || {
-            count: 0,
-            blockedUntil: null,
-            lastAttempt: now,
-        };
-        attempt.count += 1;
-        attempt.lastAttempt = now;
-        // Calculate scaled thresholds
-        const scaledMaxFailedAttempts = Math.ceil((this.config.maxFailedAttempts || 5) *
-            (this.config.rateLimitScaleFactor || 1.0));
-        const scaledBlockDuration = Math.ceil((this.config.blockDuration || 900000) *
-            (this.config.rateLimitScaleFactor || 1.0));
-        // Block if threshold exceeded
-        if (attempt.count >= scaledMaxFailedAttempts) {
-            attempt.blockedUntil = now + scaledBlockDuration;
-            this.logSecurityEvent("warning", "Client blocked due to failed attempts", {
-                clientId,
-                attempts: attempt.count,
-                blockedUntil: new Date(attempt.blockedUntil).toISOString(),
-                scaledMaxFailedAttempts,
-                scaledBlockDuration,
-            });
-        }
-        this.failedAttempts.set(clientId, attempt);
-    }
-    /**
-     * Clear failed attempts for a client
-     */
-    clearFailedAttempts(clientId) {
-        this.failedAttempts.delete(clientId);
-    }
-    /**
-     * Validate secret meets security requirements
-     */
-    validateSecret(secret, minLength) {
-        const minLen = minLength || 32;
-        if (!secret || typeof secret !== "string") {
-            throw new Error("RequestSignatureProtector: secret is required and must be a string");
-        }
-        const trimmedSecret = secret.trim();
-        if (trimmedSecret.length === 0) {
-            throw new Error("RequestSignatureProtector: secret cannot be empty or whitespace-only");
-        }
-        if (trimmedSecret.length < minLen) {
-            throw new Error(`RequestSignatureProtector: secret must be at least ${minLen} characters long (current: ${trimmedSecret.length})`);
-        }
-        // Check for weak secrets
-        if (this.isWeakSecret(trimmedSecret)) {
-            throw new Error("RequestSignatureProtector: secret appears to be weak. Use a cryptographically strong random value.");
-        }
-    }
-    /**
-     * Detect weak/predictable secrets
-     */
-    isWeakSecret(secret) {
-        const weakPatterns = [
-            /^[0-9]+$/, // Only numbers
-            /^[a-zA-Z]+$/, // Only letters
-            /^(.)\1+$/, // Repeated character
-            /^(123|abc|password|secret|key|test|demo|admin)/i, // Common words
-            /^[a-f0-9]{32}$/i, // Looks like MD5 (weak)
-        ];
-        return weakPatterns.some((pattern) => pattern.test(secret));
-    }
-    /**
-     * Hash secret for internal verification
-     */
-    hashSecret(secret) {
-        return crypto.createHash("sha256").update(secret).digest("hex");
-    }
-    /**
-     * Start cleanup timer for failed attempts
-     */
-    startCleanupTimer() {
-        this.cleanupTimer = setInterval(() => {
-            this.cleanupExpiredAttempts();
-        }, this.CLEANUP_INTERVAL);
-        // Don't keep process alive for cleanup
-        if (this.cleanupTimer.unref) {
-            this.cleanupTimer.unref();
-        }
-    }
-    /**
-     * Clean up expired failed attempt records
-     */
-    cleanupExpiredAttempts() {
-        const now = Date.now();
-        const expiredClients = [];
-        for (const [clientId, attempt] of this.failedAttempts.entries()) {
-            // Remove if block expired and no recent attempts
-            if (attempt.blockedUntil &&
-                now >= attempt.blockedUntil &&
-                now - attempt.lastAttempt > this.CLEANUP_INTERVAL) {
-                expiredClients.push(clientId);
-            }
-        }
-        expiredClients.forEach((clientId) => this.failedAttempts.delete(clientId));
-    }
-    /**
-     * Block the request with appropriate error response
-     */
-    blockRequest(res, code, details, clientId) {
-        const isDevelopment = this.config.debug;
-        const response = {
-            error: isDevelopment
-                ? this.config.errorMessage
-                : "Authentication required",
-            timestamp: new Date().toISOString(),
-            code: "NEHONIX_XYRS_001",
-        };
-        // Add detailed info only in debug mode
-        if (isDevelopment) {
-            response.xyrs = {
-                module: "RequestSignature",
-                code,
-                details,
-                requiredHeader: this.HEADER_NAME,
-                hint: "Include the X-XyRS header with your configured secret value",
-            };
-        }
-        if (this.config.debug && clientId) {
-            this.logger.debug("security", "XyRS blocking request", {
-                code,
-                details,
-                clientId,
-                requiredHeader: this.HEADER_NAME,
-            });
-        }
-        res.status(this.config.statusCode).json(response);
-    }
-    /**
-     * Log security events
-     */
-    logSecurityEvent(level, message, metadata) {
-        if (this.config.debug) {
-            const logMethod = level === "error"
-                ? "error"
-                : level === "warning"
-                    ? "warn"
-                    : "debug";
-            this.logger[logMethod]("security", message, metadata);
-        }
-    }
-    /**
-     * Update configuration with strict validation
-     */
-    updateConfig(newConfig) {
-        if (newConfig.secret !== undefined) {
-            this.validateSecret(newConfig.secret, newConfig.minSecretLength);
-        }
-        this.config = { ...this.config, ...newConfig };
-    }
-    /**
-     * Get current configuration (without exposing the secret)
-     */
-    getConfig() {
-        return {
-            errorMessage: this.config.errorMessage,
-            statusCode: this.config.statusCode,
-            debug: this.config.debug,
-            caseSensitive: this.config.caseSensitive,
-            trimValue: this.config.trimValue,
-            hasSecret: !!this.config.secret,
-            maxHeaderLength: this.config.maxHeaderLength,
-            maxFailedAttempts: this.config.maxFailedAttempts,
-            blockDuration: this.config.blockDuration,
-            disableRateLimiting: this.config.disableRateLimiting,
-            rateLimitScaleFactor: this.config.rateLimitScaleFactor,
-            minSecretLength: this.config.minSecretLength,
-            timingSafeComparison: this.config.timingSafeComparison,
-            rejectSuspiciousPatterns: this.config.rejectSuspiciousPatterns,
-        };
-    }
-    /**
-     * Get the header name used for signatures
-     */
-    getHeaderName() {
-        return this.HEADER_NAME;
-    }
-    /**
-     * Validate if a signature would be accepted (for testing)
-     */
-    validateSignature(signature) {
-        if (!signature || typeof signature !== "string") {
-            return false;
-        }
-        if (!this.validateHeaderLength(signature)) {
-            return false;
-        }
-        if (this.config.rejectSuspiciousPatterns &&
-            this.containsSuspiciousPatterns(signature)) {
-            return false;
-        }
-        const processedSignature = this.processSignatureValue(signature);
-        const expectedSignature = this.processSignatureValue(this.config.secret);
-        return this.compareSignatures(processedSignature, expectedSignature);
-    }
-    /**
-     * Get statistics about failed attempts (for monitoring)
-     */
-    getSecurityStats() {
-        const now = Date.now();
-        let blockedCount = 0;
-        for (const attempt of this.failedAttempts.values()) {
-            if (attempt.blockedUntil && now < attempt.blockedUntil) {
-                blockedCount++;
-            }
-        }
-        return {
-            trackedClients: this.failedAttempts.size,
-            blockedClients: blockedCount,
-        };
-    }
-    /**
-     * Cleanup resources
-     */
-    destroy() {
-        if (this.cleanupTimer) {
-            clearInterval(this.cleanupTimer);
-        }
-        this.failedAttempts.clear();
-    }
-}
-
-export { RequestSignatureProtector };
-//# sourceMappingURL=RequestSignatureProtector.js.map